Jakob Koschel
32b0c05460
vt_ioctl: add array_index_nospec to VT_ACTIVATE ...
commit 28cb138f559f8c1a1395f5564f86b8bbee83631b upstream.
in vt_setactivate an almost identical code path has been patched
with array_index_nospec. In the VT_ACTIVATE path the user input
is from a system call argument instead of a usercopy.
For consistency both code paths should have the same mitigations
applied.
Kasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh
Razavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU
Amsterdam.
Co-developed-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com>
Signed-off-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com>
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
Link: https://lore.kernel.org/r/20220127144406.3589293-2-jakobkoschel@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-16 12:43:54 +01:00
ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
2022-01-27 08:47:38 +01:00
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
2021-11-12 13:18:01 +01:00
binder: use wake_up_pollfree()
2021-12-14 10:04:48 +01:00
libata: add horkage for ASMedia 1092
2021-12-14 10:04:48 +01:00
atm: nicstar: register the interrupt handler in the right place
2021-07-20 16:21:08 +02:00
auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
2021-11-26 11:48:38 +01:00
regmap: Fix possible double-free in regcache_rbtree_exit()
2021-11-02 17:39:23 +01:00
bcma: Fix memory leak for internally-handled cores
2021-09-22 11:43:02 +02:00
floppy: Add max size check for user space request
2022-01-27 08:47:37 +01:00
Bluetooth: bfusb: fix division by zero in send path
2022-01-27 08:47:30 +01:00
bus: qcom: Put child node before return
2021-05-22 10:40:23 +02:00
cdrom: gdrom: initialize global variable at init time
2021-05-26 11:29:07 +02:00
char/mwave: Adjust io port register size
2022-01-27 08:47:35 +01:00
clk: kirkwood: Fix a clocking boot regression
2021-09-22 11:43:02 +02:00
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
2021-03-03 17:44:37 +01:00
cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
2021-10-06 10:23:41 +02:00
cpuidle: Fix kobject memory leaks in error paths
2021-11-26 11:48:33 +01:00
crypto: qce - fix uaf on qce_ahash_register_one
2022-01-27 08:47:33 +01:00
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
2020-10-01 20:40:02 +02:00
dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
2022-01-27 08:47:41 +01:00
EDAC/xgene: Fix deferred probing
2022-02-08 18:15:30 +01:00
extcon: max8997: Add missing modalias string
2021-07-20 16:21:05 +02:00
firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
2021-04-07 12:05:40 +02:00
firmware: arm_scpi: Fix string overflow in SCPI genpd driver
2021-12-22 09:05:15 +01:00
gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
2022-01-27 08:47:37 +01:00
drm/nouveau: fix off by one in BIOS boundary checking
2022-02-08 18:15:29 +01:00
HID: apple: Do not reset quirks when the Fn key is not found
2022-01-27 08:47:36 +01:00
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 08:47:37 +01:00
hyperv/vmbus: include linux/bitops.h
2021-11-26 11:48:20 +01:00
hwmon: (lm90) Reduce maximum conversion rate for G781
2022-02-08 18:15:28 +01:00
intel_th: Consistency and off-by-one fix
2021-05-22 10:40:16 +02:00
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
2022-01-27 08:47:39 +01:00
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-12 11:47:36 +02:00
iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
2021-12-14 10:04:50 +01:00
RDMA/rxe: Fix a typo in opcode name
2022-01-27 08:47:41 +01:00
Input: i8042 - Fix misplaced backport of "add ASUS Zenbook Flip to noselftest list"
2022-02-16 12:43:52 +01:00
iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
2022-02-08 18:15:29 +01:00
ipack: ipoctal: fix module reference leak
2021-10-06 10:23:42 +02:00
irqchip: nvic: Fix offset for Interrupt Priority Offsets
2021-12-14 10:04:50 +01:00
mISDN: change function names to avoid conflicts
2022-01-11 13:38:13 +01:00
leds: ktd2692: Fix an error handling path
2021-07-20 16:21:05 +02:00
mcb: fix error handling in mcb_alloc_bus()
2021-10-06 10:23:39 +02:00
dm space map common: add bounds check to sm_ll_lookup_bitmap()
2022-01-27 08:47:38 +01:00
media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
2022-01-29 10:15:58 +01:00
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
2021-11-26 11:48:37 +01:00
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-26 11:48:34 +01:00
scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
2020-11-10 10:23:57 +01:00
mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
2022-01-27 08:47:31 +01:00
misc: lattice-ecp3-config: Fix task hung when firmware load failed
2022-01-27 08:47:36 +01:00
moxart: fix potential use-after-free on remove path
2022-02-11 08:41:17 +01:00
mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
2021-11-26 11:48:38 +01:00
bonding: pair enable_port with slave_arr_updates
2022-02-16 12:43:53 +01:00
nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
2021-11-26 11:48:39 +01:00
NTB: hw: amd: fix an issue about leak system resources
2020-10-29 09:05:41 +01:00
libnvdimm/dimm: Avoid race between probe and available_slots_show()
2021-03-03 17:44:44 +01:00
nvme-pci: Fix an error handling path in 'nvme_probe()'
2021-09-22 11:42:57 +02:00
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-27 09:33:58 +02:00
of: Fix truncation of memory sizes on 32-bit platforms
2021-07-20 16:21:05 +02:00
parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
2022-01-27 08:47:41 +01:00
parport: remove non-zero check on count
2021-09-22 11:43:07 +02:00
PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
2022-01-27 08:47:32 +01:00
pcmcia: fix setting of kthread task states
2022-01-27 08:47:35 +01:00
phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
2021-07-20 16:21:05 +02:00
pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
2021-09-22 11:43:04 +02:00
platform/x86: apple-gmux: use resource_size() with res
2022-01-05 12:31:24 +01:00
power: bq25890: Enable continuous conversion for ADC at charging
2022-01-27 08:47:40 +01:00
powercap: restrict energy meter to root access
2020-11-10 21:04:57 +01:00
powerpc/ps3: use dma_mapping_error()
2020-12-29 13:45:00 +01:00
ptp_pch: Load module automatically if ID matches
2021-10-17 10:05:39 +02:00
pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered
2021-09-26 13:36:18 +02:00
rapidio: handle create_workqueue() failure
2021-05-26 11:29:06 +02:00
regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
2021-11-26 11:48:22 +01:00
remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
2021-02-23 13:59:14 +01:00
reset: ti-syscon: fix to_ti_syscon_reset_data macro
2021-07-28 09:14:24 +02:00
rtc: cmos: Evaluate century appropriate
2022-02-08 18:15:29 +01:00
scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
2022-02-08 18:15:26 +01:00
scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
2022-02-08 18:15:29 +01:00
maple: fix wrong return value of maple_bus_init().
2021-11-26 11:48:41 +01:00
soc/tegra: fuse: Fix bitwise vs. logical OR warning
2021-12-22 09:05:14 +01:00
spi: mediatek: Avoid NULL pointer crash in interrupt
2022-02-08 18:15:29 +01:00
ssb: sdio: Don't overwrite const buffer if block_write fails
2021-07-20 16:20:57 +02:00
staging: fbtft: Fix error path in fbtft_driver_module_init()
2022-02-16 12:43:53 +01:00
scsi: target: iscsi: Make sure the np under each tpg is unique
2022-02-16 12:43:53 +01:00
thermal: core: Reset previous low and high trip during thermal zone init
2021-12-08 08:45:05 +01:00
vt_ioctl: add array_index_nospec to VT_ACTIVATE
2022-02-16 12:43:54 +01:00
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:10:53 +02:00
usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
2022-02-16 12:43:53 +01:00
vfio: Use config not menuconfig for VFIO_NOIOMMU
2021-09-22 11:43:04 +02:00
vhost/vsock: fix incorrect used length reported to the guest
2021-12-08 08:45:04 +01:00
vgacon: Propagate console boot parameters before calling `vc_resize'
2021-12-08 08:45:06 +01:00
drivers/virt/fsl_hypervisor: Fix error handling path
2020-10-29 09:05:35 +01:00
virtio_pci: Support surprise removal of virtio pci device
2022-01-11 13:38:11 +01:00
w1: Misuse of get_user()/put_user() reported by sparse
2022-01-27 08:47:39 +01:00
watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
2021-11-26 11:48:38 +01:00
xen: detect uninitialized xenbus in xenbus_init
2021-12-08 08:45:02 +01:00
32b0c05460